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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
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Status 

1 )[>3 Responsive to communication(s) filed on 26 December 2006 . 
2a)D This action is FINAL. 2b)^ This action is non-final. 

3) Q Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) ^3 Claim(s) 1-13 is/are pending in the application. 
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5) D Claim(s) is/are allowed. 

6) K Claim(s) 1-13 is/are rejected, 

7) D Claim(s) is/are objected to. 

8) Q Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) Q The specification is objected to by the Examiner. 

10)^ The drawing(s) filed on 06 March 2001 is/are: a)S accepted or b)Q objected to by the Examiner. 
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DETAILED ACTION 



Continued Examination Under 37 CFR 1. 1 14 

1. A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.114, and the fee set 
forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on October 
30, 2006 has been entered. 

Response to Arguments 

2. Applicant's arguments filed have been fully considered but they are not 
persuasive. It is argued by the applicant that it is not taught of "the proscribed code 
scanner reviewing information pre-existing in the code prior to the code being 
intercepted and processed by the apparatus". 

The examiner disagrees with the applicant's assertion. The teachings of Ranger 
are relied upon for disclosing the proscribed code scanner reviews information pre- 
existing in the code prior to the code being intercepted and processed by the apparatus, 
see column 3, lines 30-41 & 47-54. The pre-existing content, or original data, is 
encrypted and packaged for transmission. The pre-existing data, or original data, is 
scanned by the proscribed scanner, or virus scanner, for malicious content. The data is 
never altered or changed in light of the teachings of Ranger, it is first decrypted in order 
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to scan the content for viruses. The original data that is encrypted and decrypted 
always pre-exists, the appearance is altered through use of encryption and decryption 
functions according to the teachings of Ranger. 

3. The applicant has indicated that if the examiner maintains the nonstatutory 
obviousness-type double patenting rejection, a terminal disclaimer would be filed. The 
examiner is maintaining the obviousness-type double patenting rejection. 



Double Patenting 

4. The nonstatutory double patenting rejection is based on a judicially created 
doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the 
unjustified or improper timewise extension of the "right to exclude" granted by a patent 
and to prevent possible harassment by multiple assignees. A nonstatutory 
obviousness-type double patenting rejection is appropriate where the conflicting claims 
are not identical, but at least one examined application claim is not patentably distinct 
from the reference claim(s) because the examined application claim is either anticipated 
by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 
F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 1 1 F.3d 1046, 29 
USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 
1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 
F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 
644 (CCPA 1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1 .321 (c) or 1 .321 (d) 
may be used to overcome an actual or provisional rejection based on a nonstatutory 
double patenting ground provided the conflicting application or patent either is shown to 
be commonly owned with this application, or claims an invention made as a result of 
activities undertaken within the scope of a joint research agreement. 

Effective January 1 , 1994, a registered attorney or agent of record may sign a 
terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply 
with 37 CFR 3.73(b). 

5. Claims 1-13 are provisionally rejected on the ground of nonstatutory 
obviousness-type double patenting as being unpatentable over claims 4-17 of 
copending Application No. 09/800,328. Although the conflicting claims are not identical, 
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they are not patentably distinct from each other because claims 1-14 of the instant 
application are envisioned by copending Application No. 09/800,328 in that claims 4-17 
of the copending application contain all the limitations of claims 1-14 of the instant 
application. Claims 1-14 of the instant application therefore is not patentably distinct 
from the copending application, and as such, is unpatentable for obvious-type double 
patenting. 

This is a provisional obviousness-type double patenting rejection because the 
conflicting claims have not in fact been patented. 

6. Claims 1-1 3 are provisionally rejected on the ground of nonstatutory 
obviousness-type double patenting as being unpatentable over 1-36 of copending 
Application No. 10/655,387. Although the conflicting claims are not identical, they are 
not patentably distinct from each other because claims 1-14 of the instant application 
are envisioned by copending Application No. 10/655,387 in that claims 1-36 of the 
copending application contain all the limitations of claims 1-14 of the instant application. 
Claims 1-14 of the instant application therefore is not patentably distinct from the 
copending application, and as such, is unpatentable for obvious-type double patenting. 

This is a provisional obviousness-type double patenting rejection because the 
conflicting claims have not in fact been patented. 

7. Claims 1-13 are provisionally rejected on the ground of nonstatutory 
obviousness-type double patenting as being unpatentable overclaims 1-12 of 
copending Application No. 09/838,979. Although the conflicting claims are not identical, 
they are not patentably distinct from each other because claims 1-14 of the instant 
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application are envisioned by copending Application No. 09/838,979 in that claims 1-12 
of the copending application contain all the limitations of claims 1-14 of the instant 
application. Claims 1-14 of the instant application therefore is not patentably distinct 
from the copending application, and as such, is unpatentable for obvious-type double 
patenting. 

This is a provisional obviousness-type double patenting rejection because the 
conflicting claims have not in fact been patented. 

Claim Rejections - 35 USC §103 

8. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

9. Claims 1-13 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Hawe et al, U.S. Patent 5,070,528 in view of Ranger et al, U.S. Patent 6,393,568. 

As per claim 1 , it is taught by Howe et al of an apparatus and method for 
intercepting and processing code on a communications channel. The protocol is parsed 
(by means of a protocol parser) and then transferred to be decrypted (by means of a 
decryption component)(col. 10, lines 38-44 and col. 10, line 63 through col. 11, line 1) 
and it is interpreted by the examiner that the code is intercepted by the protocol parsing 
means as it is transmitted through the communication channel since it is disclosed by 
Hawe et al that the basic step of identifying the protocol (by means of a protocol 
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scanner) used to generate the packets determines which type of encryption is needed 
(col. 10, lines 38-44). The teachings of Hawe et al fail to disclose of a proscribed code 
scanner that scans the decrypted code and that the scanner reintroduces to the 
communication channel all, some, or none of the intercepted code. It is disclosed by 
Ranger et al that encrypted information is decrypted prior to scanning by a content 
inspection mechanism (proscribed code scanner)(col. 2, lines 40-43 & 58-61). Ranger 
et al teaches of indicating the presence of the proscribed code if the indicator is positive 
(col. 6, lines 32-43). The proscribed code scanner reviews information pre-existing in 
the code prior to the code being intercepted and processed by the apparatus (col. 3, 
lines 30-41 & 47-54). The scanner reintroduces to the communication channel all, . 
some, or none of the intercepted code (col. 4, lines 38-50 and col. 6, lines 24-28 & 32- 
43). It would have been obvious to a person of ordinary skill in the art at the time of the 
invention to have been motivated to apply decryption prior to scanning for viruses. 
Ranger et al discloses motivational benefits by decrypting code prior to scanning for 
viruses by reciting by discussing a need for detecting viruses in communications 
received in encrypted form such that it would provide virus detection in real time for a 
communication system (col. 1 , lines 58-64) and virus programs are not able to decrypt 
encrypted information (col. 1, lines 21-23). It would have been obvious that the 
teachings of Hawe et al would have found the teachings of Ranger et al beneficial as a 
means of efficiently scanning encrypted files for viruses by decrypting the files prior to 
scanning for viruses to provide real time content inspection for viruses. 
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As per claims 2 and 3, Hawe et al discloses of intercepting code prior to 
decrypting the encrypted code (col. 10, lines 38-44). It is interpreted by the examiner 
that the secure/altered code is intercepted by the protocol parsing means in as it is 
transmitted through the communication channel since it is disclosed by Hawe et al that 
the basic step of identifying the protocol (by means of a protocol scanner) used to 
generate the packets determines which type of encryption is needed (col. 10, lines 38- 
44). Ranger et al is. relied upon for disclosing that encrypted information is decrypted 
prior to scanning by a content inspection mechanism (proscribed code scanner in a 
separate system)(col. 2, lines 40-43 & 58-61). The presence of the proscribed code is 
indicated if the indicator is positive (by means of an indicator)(col. 6, lines 32-43). 
Please refer above for the motivational benefits of the teachings of Ranger et al as 
applied to Hawe et al. 

As per claims 4 and 13, Ranger et al teaches of scanning the code for the 
presence of proscribed code further comprising scanning the code for the presence of 
viruses (col. 6, lines 32-43). 

As per claims 5,6, and 11, it is interpreted by the examiner that the code is 
configured for interception parameters by the protocol parsing means in as it is 
transmitted through the communication channel since it is disclosed by Hawe et al that 
the basic step of identifying the protocol (by means of a protocol scanner p reconfigured) 
used to generate the packets determines which type of encryption is needed (col. 10, 
lines 38-44). 
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As per claims 7 and 8, it is taught by Howe et al of an apparatus and method for 
intercepting and processing code on a communications channel. The protocol is parsed 
(by means of a protocol parser) and then transferred to be decrypted (by means of a 
decryption component)(col. 10, lines 38-44 and col. 10, line 63 through col. 11, line 1) 
and it is interpreted by the examiner that the code is intercepted by the protocol parsing 
means as it is transmitted through the communication channel since it is disclosed by 
Hawe et al that the basic step of identifying the protocol (by means of a protocol 
scanner) used to generate the packets determines which type of encryption is needed 
(col. 10, lines 38-44). The teachings of Hawe et al fail to disclose of a proscribed code 
scanner that scans the decrypted code. It is disclosed by Ranger et al that encrypted 
information is decrypted prior to scanning by a content inspection mechanism 
(proscribed code scanner)(col. 2, lines 40-43 & 58-61). Ranger et al teaches of . 
indicating the presence of the proscribed code if the indicator is positive (col. 6, lines 32- 
43). The proscribed code scanner reviews information pre-existing in the code prior to 
the code being intercepted and processed by the apparatus (col. 3, lines 30-41 & 47- 
54). It would have been obvious to a person of ordinary skill in the art at the time of the 
invention to have been motivated to apply decryption prior to scanning for viruses. 
Ranger et al discloses motivational benefits by decrypting code prior to scanning for 
viruses by reciting by discussing a need for detecting viruses in communications 
received in encrypted form such that it would provide virus detection in real time for a 
communication system (col. 1 , lines 58-64) and virus programs are not able to decrypt . 
encrypted information (col. 1 , lines 21-23). It would have been obvious that the 
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teachings of Hawe et al would have found the teachings of Ranger et al beneficial as a 
means of efficiently scanning encrypted files for viruses by decrypting the files prior to • 
scanning for viruses to provide real time content inspection for viruses. 

As per claim 9, Ranger et al discloses of re-encrypting (returning) code if it is fully 
trusted (indicator is negative)(col. 7, lines 20-27). Please refer above for the 
motivational benefits of the teachings of Ranger et al as applied to Hawe et al. 

As per claim 10, Ranger et al teaches of indicating the presence of the 
proscribed code if the indicator is positive (col. 6, lines 32-43). Please refer above for 
the motivational benefits of the teachings of Ranger et al as applied to Hawe et al. 

As per claim 12, Hawe et al discloses of intercepting code prior to decrypting the 
encrypted code (col. 10, lines 38-44). Ranger et al is relied upon for disclosing that 
encrypted information is decrypted prior to scanning by a content inspection mechanism 
(proscribed code scanner in a separate system)(col. 2, lines 40-43 & 58-61). The 
presence of the proscribed code is indicated if the indicator is positive occurring on a 
separate machine (col. 6, lines 32-43). Please refer above for the motivational benefits 
of the teachings of Ranger et al as applied to Hawe et al. 

Conclusion 

1 0. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Christopher A. Revak whose telephone number is 571- 
272-3794. The examiner can normally be reached on Monday-Friday, 6:30am-3:00pm. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on 571-272-3795. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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